4696 matches found
CVE-2018-19582
Removed by vendor...
CVE-2018-19576
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...
CVE-2018-19576
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...
CVE-2018-19575
GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...
Design/Logic Flaw
GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...
CVE-2018-19575
GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...
CVE-2018-19575
GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue that allows a user to make comments on a locked issue...
CVE-2018-19575
Removed by vendor...
CVE-2018-19575
CVE-2018-19575 affects GitLab CE/EE: versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1 are vulnerable to an insecure direct object reference that allows a user to comment on a locked issue. Root cause is an insecure direct object reference in issue commenting log...
CVE-2018-19576
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...
CVE-2018-19576
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...
CVE-2018-19576: Improper Access Control
GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential...
PT-2019-9865
Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.4 before 11.4.8 GitLab EE versions 11.5 before 11.5.1 Description The issue is related to an insecure direct object reference, allowing unauthorized users to publish draft merge request comments of other users...
PT-2019-9858
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1 through 11.5 Description The issue allows a user to make comments on a locked issue due to an insecure direct object reference. Recommendations For versions 10.1 through 11.3.10, update to version 11.3.11 or later. F...
CVE-2018-19582: Authorization Bypass Through User-Controlled Key
GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized user to publish the draft merge request comments of another user...
PT-2019-9859
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 8.6 up to 11.3.10 GitLab CE/EE versions 11.4 up to 11.4.7 GitLab CE/EE versions 11.5 up to 11.5.0 Description The issue allows a Guest user to make changes to or delete their own comments on an issue after the issue was...
Preparing for PCI DSS 4.0
PCI DSS 4.0 is currently in its request for comments RFC process, where the industry can provide comments and feedback to help shape the next iteration. This process is initially open to the participating organizations - members that help steer and inform the PCI SSC based on their experiences. T...
WordPress: pre-auth Stored XSS in comments via javascript: url when administrator edits user supplied comment
When a comment is submitted, it is filtered via wprelnofollowcallback, which adds the rel attribute to tags within the anchor: function wprelnofollowcallback $matches $text = $matches1; $atts = shortcodeparseatts $matches1 ; $rel = 'nofollow'; if ! empty $atts'href' if inarray strtolower wpparseu...
Shopify: any staff members have the ability to comment in [discounts] he/she can disable comment section it to other staff even the admin of the store
Hi, I found this cool behavior by mistake when I was testing for some GraphQL, any user have ability to comment in discounts code at discounts section can turn off comments to the other staff members include the admin/manager of the store. this happens because when the GraphQL used to create a...
